The AI tool directory

Terms incorporate the published BAA when HIPAA applies, without a stated plan exclusion. Pricing separately lists a signed BAA on Enterprise. Confirm which agreement applies to your account; review consent, retention, sharing and connected destinations.

Request and obtain a BAA before PHI use. No enterprise contract is required; endpoint exceptions still apply.

Eligible US clinicians can sign a workspace BAA in Settings > Agreements. OpenAI’s Codex guide includes clinician accounts with the applicable BAA, required Codex access and configuration. Team rollouts and third-party services require their own scope.

Eligible sales-managed Enterprise or Edu accounts may obtain a BAA. Confirm the organization’s covered workspace and features.

HIPAA must be activated by the Primary Owner. Eligible chat and file/code features are covered; external websites, third-party data flows and excluded beta services are not.

Eligible first-party API features require a signed BAA and HIPAA-enabled organization. Console use, Claude Code, partner platforms and external services are outside this API arrangement. Verify the current feature table.

Configured Codex Local can use an eligible Healthcare, Clinicians or Regulated ChatGPT account with the applicable BAA and required access, or BAA-covered API Services with Modified Retention. Codex cloud is excluded; third-party services need separate approval.

Eligible CLI or desktop local configurations require the applicable BAA and separately enabled ZDR; qualified Enterprise or commercial API arrangements differ. Consumer plans, remote mode, web, review, security, computer use and remote control are not covered. Verify the exact arrangement.

BAA is incorporated in platform terms for individual clinicians and small practices. Larger organizations may need a separate agreement; clinic approval still matters.

A super administrator accepts the BAA in Account > Account settings > Legal and compliance. Included functionality lists managed Gemini, Docs, Sheets, Forms, Meet and Apps Script. Gemini in Chrome and third-party add-ons are excluded. Check feature licensing and sharing controls.

Security page describes PHI processing under its standard BAA or customer-specific agreement. Confirm the agreement that applies to your account.

Named on Google Cloud’s HIPAA-supported list. Requires an applicable Cloud BAA, licensed Cloud setup and appropriate configuration; pre-GA features are excluded unless expressly covered.

BAA applies with the underlying Covered Entity service agreement. Confirm the purchased services and integration scope.

Heidi now states a BAA is available to every covered entity it works with. Obtain and review your agreement before PHI; do not assume signup alone completes this.

In-scope commercial/GCC services under Microsoft’s applicable DPA/BAA. Personal accounts and separate third-party data flows do not inherit this coverage.

Enterprise BAA and required HIPAA configuration. Notion AI supports PHI; beta services remain excluded. Not for communication with patients, members or their families.